Add deployment step for removing and merging roles

[MikeAlhayek]

Is your feature request related to a problem? Please describe.

Currently, we have RoleStep that would allow the user to create new roles. This step always removes all existing claims and loads only the claims you provide. This is a good step for introducing new roles.

However, in OC 1.6, the startup recipe will define which roles to user. Then the user want to update the existing role permissions, they have to list all the roles manually.

Describe the solution you'd like

It would be nice to add a property to the RoleStep to control the behavior of permission handling. For example, add a property called "PermissionBehavior", when the value is Replace "default", we would replace permission as we do today. However, if a user set it to Merge then we could just combine the permissions instead of removing existing.

Additionally, add a new step RemoveRoleStep that would allow us to remove existing roles.

[jtkech]

Yes, already part of one of my too long comment #13040 (comment) ;)

RoleStep: Hmm a little annoying, it specifies permissions (can be empty) that also rely on features activation, maybe the step should merge (not replace) permissions, at least when in a setup recipe, or maybe a new step for role creation only and if it already exists don't replace/clear its permissions.